Do I need a cookie banner for my website analytics?

The rule in Europe

The EU’s ePrivacy rules say that storing information on a visitor’s device, or reading it back, needs their consent unless it’s strictly necessary for a service they asked for (ePrivacy Directive, Article 5(3)). An analytics cookie isn’t necessary for the page to work, so by default it needs consent. The UK has the same rule in its own law.

The exceptions for analytics

Some regulators accept analytics without consent under strict conditions:

• France: the CNIL exempts audience measurement if, among other things, it’s used only to measure your own site, the data isn’t cross-checked with other processing such as customer files, visitors are told and can object, and the cookie lasts no more than 13 months (CNIL: analytics).
• UK: since the Data (Use and Access) Act 2025, the ICO describes an exception for statistics about how a service is used, to improve it, when the result is aggregate data and visitors get clear information and a free way to object. The ICO says consent is still needed for connecting a visitor id to activity such as purchases shared with advertisers (ICO: the exceptions).

The common thread: counting visits in aggregate can be exempt; following a person across visits to a signup or a payment is not.

Your three choices

1. Count without storing anything. No cookie and no local storage means no device storage to consent to. You get visits, pages, sources and countries, but not returning visitors, and you can’t trace a payment back to a first visit across days.
2. Store an id only after consent. A banner, and the full picture for people who say yes. Visitors who say no are still counted, without the id.
3. Store an id everywhere. Only where the visitor’s own rules allow it; outside Europe it’s often the default, but check the rules where your visitors are.

Many founders mix them: ids outside Europe, consent inside it.

What a banner costs you

Some visitors decline, and some ignore the banner. Their visits can still be counted without an id, but they won’t be linked to a later signup or payment. Plan for a picture that’s partly traced, and look at how many customers could be traced rather than assuming all of them were.

With Nordva Launch

Launch’s script has four modes, set per site in the dashboard. Auto (the default) gives visitors outside the EEA, the UK and Switzerland a first-party visitor id and waits for your banner’s yes inside them; consent waits for a yes everywhere; cookies stores the id everywhere; no cookies stores nothing in any browser. In every mode, a browser sending Global Privacy Control counts as no, and no IP address or full user agent is stored. The cookies page lists every cookie per mode, so your own notice can name them. Which mode is right for your site is your decision.